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(54) Abstract Title 

Backup of booting and FAT information for virus recovery 

(57) Both booting information required to boot a hard disc drive and the file allocation table (FAT) are backed 
up 19 in the maintenance area 1 of the disc, which area Is inaccessible to the virus. Hence the working versions 
of the booting Information and FAT, which both reside in the working area 2, may be restored from uninfected 
versions periodically backed-up in the backup area 19. Backup may alternatively occur during initial booting. 
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DATA PROCESSING METHOD AMD SYSTEM 

The present invention relates to a hard disk drive, and in 
particular, to a method of additionally providing the function of 
restoring data damaged by a computer virus in a hard disk drive- 
in a hard disk drive, widely used as an auxiliary memory device 
for a computer system by virtue of its high data storage capacity, data 
is magnetically recorded on a magnetic disk (referred to as a disk, 
hereinafter) . The hard disk drive has been increasingly used as 
personal computers (PCs) have proliferated. 

Along with the increased provision and use of computers to general 
users, viral damage has also increased, including loss of stored data 
or shut-down of a computer system by a computer virus (hereinafter, 
referred to as a virus) . 

More specifically, a virus is a kind of software program that 
operates in relation to computer memory, storage devices, data and 
software and is stored in a file like a general program. The virus 
gives rise to many problems such as changing or erasing an existing 
file or the structure of a system, damaging data, destroying program 
files by re-formatting the or a hard disk, and locking-up the 
computer. The virus can also reproduces itself in another disk or 
computer . 

A disk is infected with a virus by copying a virus-infected file 
or simply by viewing the file directory of the file in some cases. 

To restore such a virus-infected disk, a so-called vaccine program 
has emerged for removal of the virus and recovery of damaged data. 
However, the kinds of viruses are increasing due to the increased use 
of computers, and the viruses act more subversively. Under these 
circumstances, it is impossible to cope with the viruses with vaccine 
programs for protecting data against viral damages. 

An object of the present invention is to provide a method of 
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restoring data damaged by a virus in a hard disk drive. 

Accordingly, a first aspect of the present invention provides A 
data processing method for restoring data stored on a storage medium of 
a data storage device in the event of damage by a computer virus the 
method, comprising the steps of: backing up system information of the 
storage device into a predetermined area inaccessible to the computer 



virus. 



once virus damaged has been sustained, it .ill be necessary to 
5 recover the state of the disk prior art the virus damage, accordxngly. 
an emboaiment provides a method further comprising the steps of 
restoring the system information from the backed up system xnformatron 
^n tn" system information has been infected with the computer virus. 

critical information which could readily render a disk unusable 
may be the system information. Therefore, preferably, an embod-ent 
provide, a method wherein the system information includes booting 
Sorption retired to boot the hard disk drive. Preferably- • - ^ 
" provided wherein the booting information is master boot record (MBR) 
25 and information in a boot sector. 

Still further, an embodiment provides a method wherein the system 
information includes file position information indicating the position 
If a file on the disk. » the event that the latest version of the 
„ position information, eg m table, has been damaged and a damaged 
version of the position information has been stored in the 
2 d termined area, an embodiment of the present invention prides a 
Lthod Wherein the file position information backed up 
predetermined area comprises the latest P™^*"" ~* 

35 at least one previous file position information. Preferably, an 
embodiment provides a method wherein the file position infection 
includes a file allocation table (FAT) . 

Since a virus may strike at any time without warning during the 
<= a romnuter an embodiment provides a method wherem the 
W ZTIZ:^"^ - ~ - predetermined area is updated 
if at least one predetermined condition has been satisfied. 
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Preferably, the predetermined condition is the initial booting of the 
storage device. Additionally or alternatively, the predetermined 
condition may be the elapse of a predetermined period of time. 

Preferably, a method is provided wherein the predetermined area of 
the disk is a maintenance area of the disk. 

A second aspect of the present invention provides a data storage 
device comprising a data storage medium, the device, comprising means 
for backing up system information of the storage device into a 
predetermined area of the storage medium inaccessible to a computer 
virus. 

Preferably, the data storage device further comprising means for 
restoring the system information from the backed up system information 
when the system information has been infected with the computer virus. 

Advantageously, the present invention allows the correct operation 
of a storage medium to be restored in the event of damage by a virus 
and particularly, provides a method of restoring a system and a file 
recorded on a disk, which can not be booted and read, respectively, 
due to the virus. This affords greater protection for user data and 
increase the reliability of a hard disk drive by reducing rapidly 
increasing viral damages. 

An embodiment provides a method of restoring data damaged by a 
computer virus on a magnetic information recording disk in a hard disk 
drive. In the data restoring method, booting information required to 
boot the hard disk drive and file position information indicating the 
position of a file when data is stored in a file unit are backed up in 
a predetermined portion of a maintenance area on the disk. The booting 
information or the file position information is restored based on the 
backed up information when the booting information or the file position 
information has been infected with a computer virus. 

Advantageously, the microprocessor 10 in the hard disk drive as 
constituted above is able to restore data damaged by a virus. 



5 Embodiments of the present invention will now be described, by way 

of example only, with reference to the accompanying drawings in which: 

figure 1 is a block diagram of a hard disk drive to which the 
present invention is applied; 

figure 2 is an exemplary format diagram of an information 
10 recording disk shown in figure 1; and 

figures 3A and 3B are detailed format diagrams of a data area 

shown in 3. 

A preferred embodiment of the present invention will be described 
15 in detail. While details such as a method of storing a file allocation 
table (FAT) are disclosed, they are mere exemplary applications for a 
comprehensive understanding of the present invention. Thus, it is 
clearly understood that many modifications can be made to these details 
by anyone skilled in the art within the scope and spirit of the present 
20 invention. 

The operation of a hard disk drive will be first described. 
Figure 1 is a block diagram of a hard disk drive to which the present 
invention is applied. Referring to figure 1, a microprocessor 10 is 
25 connected to a PROM (Programmable Read Only Memory) 12 for storing a 

specific control program and data of the microprocessor 10, and an SRAM 
(Static Random Access Memory) 14. The microprocessor controls the 
whole operation of the HDD. A head 16, fixed at an end of an actuator, 
horizontally flies over a rotating disk 18 for writing or reading data 
30 to or from the disk 18. A VCM (Voice Coil Motor) 20, positioned at the 
other end of the actuator, drives the head 16 according to the level 
and direction of a current applied to the VCM 20. A spindle motor 22 
rotates the disk 18 stacked around a drive shaft according to a control 
signal received from a motor driver 24. A VCM driver 26 is connected 
35 to the VCM 20 and controls the driving of the VCM 20. A DAC (Digital- 
to-Analog Converter) 28, connected to the microprocessor 10 and the VCM 
driver 26, receives a digital control signal from the microprocessor 
10, converts the received signal to an analog signal, and outputs the 
analog signal to the VCM driver 26. 



40 



The motor driver 24 is connected to the spindle motor 22 and the 
microprocessor 10, for controlling the driving of the spindle motor 22 
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5 under the control of the microprocessor 10. A preamplifier 30 is 
connected to the head 16, pre-amplif ies a reproduced signal, and 
outputs an write signal to the head 16 or receives a read signal from 
the head. A read/write channel circuit 32 connected to the 
microprocessor 10, the preamplifier 30, and a DDC (Disk Data 
10 Controller) 34, receives write data from the DDC 34, encodes the write 
data, and outputs the encoded write data to the preamplifier 30 under 
the control of the microprocessor 10. The read/write channel circuit 
32 converts an analog reproduction signal received from the 
preamplifier 30 to a digital signal, and outputs the digital signal as 
15 encoded read data ERD. An ADC (Analog-to-Digital Converter) 36 

connected to the read/write channel circuit 32, receives an analog 
servo reproduction signal from the read/write channel circuit 32, 
converts the received signal to a digital position error signal PES, 
and outputs the signal PES to the microprocessor 10. A gate array 38 
20 connected to the read/write channel circuit 32, receives the signal 
ERD, detects servo information such as a gray code in a servo area of 
the disk 18, and outputs the detected servo information. The DDC 34 
has a sequencer for operating according to a microprogram downloaded 
from the microprocessor 10, and records data received from an external 
25 data input device (e.g., a host computer) on the disk 18 via the 

read/write channel circuit 32 and the preamplifier 30. The DDC 34 also 
reads the data from the disk 18 and transmits the read data to the 
external data input device. The DDC 34 acts as a communication 
interface between the host computer and the microprocessor 10, and 
30 temporarily stores data transmitted between the host computer and the 
microprocessor 10 and between the host computer and the read/write 
channel circuit 32 in a buffer RAM 35. 

The microprocessor 10 for controlling the whole operation of the 
35 drive controls the DDC 34 in response to a read or write instruction 
received from the host computer, and controls track seek and track 
following. The PROM 12 stores the operation program of the 
microprocessor 10 and various designated values. 

40 According to the feature of the present invention, the 

microprocessor 10 backs up data which will cause serious problems if it 
is damaged by a virus infecting data recorded on the disk 18, that is, 
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system booting information and a IK including the titles and position, 
of recorded data files in a maintenance area inaccessible to a general 



user. 
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Figure 2 is a format diagram of a general information storing disk 
18 divided into several areas. Referring to Figure 2, the disk 18 is 
largely divided into a system area ©, a data area ©, and a parking 
zone @. 

The system area CD also called a maintenance area is Inaccessible 
«. a general user, and is used for storing system data and data used to 
repair and maintain a hard disk drive. The data area • access.bie to 
the general user, is for storing general user data. The parking zone • 
is the place -here a magnetic writing/reading device U.e ., head not 
shown) for recording data onto and reading data from the disk 18 is 
parked, and has no data recorded therein. 

as for the system area <P, a hard disk drive manufacturer records 
various pieces of system-related information in the maintenance are. ® 
of a disk, such as the specific number of a drive, fabricatxon-related 
formation, defect-log-in data, a defect list, or SHAKT .Self 
Monitoring Analysis Reporting Technology), and reads them when 
necessary. As the information recorded in the maintenance area CO is 
un^eTo the drive, it cannot be stored in a BOH and is read out to a 
PAH of the drive when necessary. One to four tracks are usually 
assigned to the maintenance area <S>. 

According to an embodiment of the present invention information 
which is likely to cause serious problems if it is damaged by a vxrus 
among pieces of information recorded on the disk 18 is stored 
beforehand in a predetermined portion 1, of the -penance area 0, 
The information may include system booting information and a FAT havi 
Z titles and positions of recorded data files. If such in ormat on 
" damaged by a virus, the system cannot be booted « 
the position information of a recorded file is damaged, file data 
, clot be restored even if the system is booted. For these reasons 

the system booting information and the FAT are often targets of a virus 
attack. When a data file is damaged by a virus, the file ,s partial,, 



5 or wholly damaged. However, possible damage of the system booting 
information and the file position information causes the serious 
problem that the data of all files recorded on a disk is inaccessible. 
Therefore, the booting information and the file position information 
are backed up in a safe area, that is, the maintenance area, so that 

10 existing information can be restored from the backed-up information in 
the event of damage. 



The booting information and the file position information are 
generally stored in the data area ©, which will be described in detail 
15 with reference to the attached drawings. 

Detailed format diagrams of the data area © for storing data are 
shown in figures 3A and 3B. As shown in figure 3A, the data area © is 
divided into several partitions. This is referred to as partitioning 
to store at least one operating system on one disk. A partition table 
having the position of each partition, that is, the starting and ending 
positions of each partition is generally positioned in sector #1 of 
cylinder #0 in head #0 usually called MBR (Master Boot Record) , as 
shown in figure 3A. The MBR has information of each partition and, 
especially, information of a partition including a boot program of a 
present operating system for booting a hard disk drive. 

In the DOS (Disk Operating System), the boot program is generally 
stored in the first sector of the first partition following the MBR, 
30 that is, of partition #1 in figure 3A. 



A detailed format diagram of partition #1 is shown in figure 3B. 
Referring to figure 3B, the area having the boot program is generally 
called a boot sector. The boot sector occupies exactly one sector and 
35 is provided in the first sector of the partition. 

When a drive is booted by turning on a computer, the 
microprocessor 10 sequentially seeks sector #1 of cylinder #0 on head 
#0 of the disk 18, reads the MBR information stored in the sector, 
40 seeks a partition having a boot program, searches for a boot sector of 
the corresponding partition, reads out the boot program to the SRAM 14, 
and implements a booting operation. Therefore, information recorded in 
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5 the MBR and the boot sector is necessary for the booting operation, as 
described above. 

in figure 3B, a FAT follows the boot sector and indicates the 
position of information stored in file units in a data area of the disk 
10 18, from a user's point of view. The FAT also stores information 

relating to data clusters which is a set of several sectors, and has 
information relating to damaged clusters and empty clusters so that xt 

an indicate which empty cluster to use when a new filers --de^nd 
prevent file data from being recorded in a damaged cluster. The FAT xs 
Ldified when a user stores a new file, changes an exxsting fxle, or 
erases the existing file. 

After a drive has been manufactured by a drive manufacturer, the 
ahove MBR, boot sector, and EAT are backed up in the V"""*"* 
portion 19 of the maintenance area The MBR and the boot sector „ 
valid unless the hard disk drive is newly initialized. *» 
is continuously modified. Therefore, the PAT should be updated 
periodically. In the embodiment of the present invention, the FAT is 
updated whenever the computer system is turned on. To prevent the « 
5 stored in the predetermined portion 19 of the maintenance area • from 
being updated according to an rAT damaged by a virus, space i, prepaid 
beforehand for at least two » in the predetermined portion 19 of the 
maintenance are. <D. and the latest »T and at least one previa M 
can be stored in the space. 

" If file position information is damaged by a virus or a drive 

cannot be booted, a drive manufacturer issues an instruct^ ^to the 
microprocessor 10 to restore an MBR, a boot sector, and an »**-»'- 
bv a virus by means of the MBR and the boot sector stored m the 
35 predeter^ned portion 19 of the maintenance area <D, and an uninfected 
£ selected fL among several F ATs. This instruction is un.oue Co 
Z* drive, Upon receiving the instruction, the microprocessor 10 
r lr data, especially, the MBR. boot sector, and rAT damaged by the 



virus. 
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According to the present invention as described above, system 
bootin, information and an BAT having the titles and pos.txons of 



5 recorded data files, which are likely cause a serious problem when they 
are damaged by a virus among various pieces of information recorded on 
an information recording disk in a hard disk drive, are backed up in a 
maintenance area inaccessible to a general user for use in restoring 
system booting information and an FAT when they have been infected with 

10 a virus. Therefore, the effects of viral damage to a hard disk drive 
are reduced, user data is protected, and the reliability of the drive 
is increased. 
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CLAIMS 



A data processing method for restoring data stored on a 
storage medium of a data storage device in the event of 
damage by a computer virus, the method, comprising the steps 
of: backing up system information of the storage device into 
a predetermined area inaccessible to the computer virus. 

A method as claimed in claim 1, further comprising the 
steps of restoring the system information from the backed up 
system information when the system information has been 
infected with the computer virus. 

A method as claimed in either of claims 1 or 2, wherein 
the system information includes booting information required 
to boot the hard disk drive. 

A method as claimed in claim 3, wherein the booting 
information is master boot record (MBR) and information in a 
boot sector. 

A method as claimed in any preceding claim, wherein the 
system information includes file position information 
indicating the position of a file on the disk. 

A method as claimed in claim 5, wherein the file 
position information backed up into the predetermined area 
comprises the latest file position information and at least 
one previous file position information. 

A method as claimed in either of claims 5 or 6, wherein 
the file position information includes a file allocation 
table (FAT). 

A method as claimed in preceding claim, wherein the 
system information is backed up into the predetermined area 
is updated if at least one predetermined condition has been 
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satisfied. 



A method as claimed in claim 8, wherein the 
predetermined condition is the initial booting of the storage 
device - 

A method as claimed in either of claims 8 or 9, wherein 
the predetermined condition is the elapse of a predetermined 

period of time- 

A method as claimed in any preceding claim, wherein the 
predetermined area of the disk is a maintenance area of the 
disk. 

A data storage device comprising a data storage medium, 
the device, comprising means for backing up system 
information of the storage device into a predetermined area 
of the storage medium inaccessible to a computer virus. 

A device as claimed in claim 12, further comprising 
means for restoring the system information from the backed up 
system information when the system information has been 
infected with the computer virus. 

A device as claimed in either of claims 12 or 13, 
wherein the system information includes booting information 
required to boot the hard disk drive. 

A device as claimed in claim 14, wherein the booting 
information is master boot record (MBR) and information in a 
boot sector. 

A device as claimed in any of claims 12 to 15, wherein 
the system information includes file position information 
indicating the position of a file on the disk. 

A device as claimed in claim 16, wherein the file 
position information backed up into the predetermined area 
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comprises the latest file position information and at least 
one previous file position information. 

A device as claimed in either of claims 16 or 17, 
wherein the file position information includes a file 
allocation table (FAT) . 

A device as claimed in any of claims 12 to 18, wherein 
the system information is backed up into the predetermined 
area is updated if at least one predetermined condition has 
been satisfied. 

A device as claimed in claim 19, wherein the 
predetermined condition is the initial booting of the storage 
device . 

A device as claimed in either of claims 19 or 20, 
wherein the predetermined condition is the elapse of a 
predetermined period of time. 

A device as claimed in any of claims 12 to 21, wherein 
the predetermined area of the disk is a maintenance area of 
the disk. 

A data processing method substantially as described 
herein with reference to and/or as illustrated in the 
accompanying drawings. 

A data storage device substantially as described herein 
with reference to and/or as illustrated in the accompanying 
drawings . 
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